Unwanted Pop-ups

You have not renamed HJT as directedin the Read and run first instructions. Please do that now. (C:\HJT\HijackThis.exe----> should be C:\HJT\analyse.exe)

Please use add/remove programs to uninstall:
J2SE Runtime Environment 5.0 Update 3
MarketResearch

Use windows explorer to find and delete:
C:\WINDOWS\b128.exe

Now

1. Download this file - Combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Attach this log to your next reply

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Next:
Remove all of your browser toolbars and extensions.

Download and install Registrar Lite

Then run Registrar Lite.

Copy and paste the below into the Address box of registrar lit and hit the Enter key.

HKEY_LOCAL_MACHINE\SYSTEM

Then click the Security pull down on the top menu and choose Take Ownership. Click OK in the next window to approve it. Now exit Registrar Lite and continue.

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Attach the logs for:

GetRun
ShowNew
HJT
ComboFix

Be sure to tell me how things are running.

 

Market Research is still showing in your add/remove program list ....it needs to go bye bye.
If it isn't showing on your add/remove list ....do a search for it and delete it.

Also would recommend you remove the popcap games ...usually loaded with adaware....otherwise you look good.

If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
* Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
8. If you are running Windows XP or Windows ME, do the below:
* go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
* Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work thru the below link:
* How to Protect yourself from malware!